CVE-2026-63343
Incus is a system container and virtual machine manager.
Published Aug 21, 2026 · updated Oct 15, 2026
Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The and paths were patched in a prior release using rejection and confinement; was not included in either patch and remains exploitable. Version 7.3.0 patches the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Aug 21, 2026 · NIST NVD
Detected
Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The and paths were patched in a prior release using rejection and confinement; was not included in either patch and remains explo
Oct 15, 2026 · NIST NVD
Updated
Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The and paths were patched in a prior release using rejection and confinement; was not included in either patch and remains explo
Sources
- CVE.orgVulnerability recordCVE-2026-63343
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-63343
Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadat
nvd.nist.gov